Federalism, State Action, and Workers' Medical Privacy

Injured workers entering state workers’ compensation systems effectively forego their medical privacy. This is due to widespread judicial misinterpretation of the HIPAA Privacy Rule (HPR) as excluding injured workers from federal medical privacy protections. As a result, medical privacy for workers’ compensation claims is effectively governed by state law. This Article argues that states have failed to protect the medical privacy of injured workers adequately and that there is a pressing need for legislative reform. The Article presents the first comprehensive survey in the legal literature of state action protecting the medical privacy of injured workers. Part I describes the data collection, including the methodology used and an overview of the results. Part II examines state response in three areas: scope of information protected, ex parte communications, and protective orders for disclosures. Detailed survey results are presented in the Appendix. Part III describes best practices among the states and provides proposals for legislative change, including the adoption of the HPR’s standards as a floor for medical privacy protections, or, alternatively, more state statutory protections to limit disclosures. I conclude by summarizing the implications of this work.